@corbado/observe 1.13.0 → 1.14.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @corbado/observe
 
+## 1.14.1
+
+### Patch Changes
+
+- 77ac0d7: Paste observation no longer copies or compares input values: it keeps only the fields' lengths and whether the browser applied the paste. The unused inserted count and the undeclared "Length of the pasted text" reader field are removed. A host-handled paste that replaces text with text of the same length, without an input event, is no longer detected.
+
+## 1.14.0
+
+### Minor Changes
+
+- 8f563e2: New tracker plugin `eventTime(stamp)` for `initCore`: every tracked event is dated by the integration's clock, `stamp(explicitTimestamp)`, instead of `explicitTimestamp ?? Date.now()`, also for SDK methods that take no timestamp (`flowStarted`, `flowFinished`, decisions, an operation's `subflow_started`). For integrations that replay host signals late (e.g. from a host-side event buffer). A clock that throws or returns a non-finite number falls back to the SDK's own dating; telemetry and low events keep their capture time. `init()` / `CorbadoTracker` are unchanged.
+
 ## 1.13.0
 
 ### Minor Changes

package/dist/analysis/index.mjs

@@ -12,6 +12,7 @@ export * from "./plugins/cross-origin-session.mjs";
 export * from "./plugins/raw-errors.mjs";
 export * from "./plugins/probes.mjs";
 export * from "./plugins/fixed-source-path.mjs";
+export * from "./plugins/event-time.mjs";
 export * from "./probe-lane.mjs";
 export * from "./transport.mjs";
 export * from "./queue.mjs";

package/dist/analysis/low-events/grouped-input-tracker.mjs

@@ -18,7 +18,7 @@ var LowEventGroupedInputTracker = class {
       {
         key: "dom:input.paste",
         title: "Paste into tracked input fields",
-        accessNote: "paste events on the input elements the integration passes to Observe; pasted values never leave the reader",
+        accessNote: "paste events on the input elements the integration passes to Observe; only the fields' lengths are compared, values are never copied or compared",
         group: "Input interaction",
         origin: "observe-external",
         fields: [
@@ -28,19 +28,12 @@ var LowEventGroupedInputTracker = class {
             category: "behavior",
             exposure: "presence",
             transform: { note: "trusted paste events only" }
-          },
-          {
-            path: "value",
-            label: "Length of the pasted text",
-            category: "behavior",
-            exposure: "size",
-            transform: { note: "inserted length only; values are compared in memory and discarded" }
           }
         ]
       },
       this.inputs,
       logger,
-      (ts, _inserted, captureSeq) => {
+      (ts, captureSeq) => {
         this.cancelChange();
         this.changes.flush();
         this.changes.markInputObserved();

package/dist/analysis/low-events/input-tracker.mjs

@@ -40,7 +40,7 @@ var LowEventInputTracker = class {
       {
         key: "dom:input.paste",
         title: "Paste into tracked input fields",
-        accessNote: "paste events on the input elements the integration passes to Observe; pasted values never leave the reader",
+        accessNote: "paste events on the input elements the integration passes to Observe; only the fields' lengths are compared, values are never copied or compared",
         group: "Input interaction",
         origin: "observe-external",
         fields: [
@@ -50,19 +50,12 @@ var LowEventInputTracker = class {
             category: "behavior",
             exposure: "presence",
             transform: { note: "trusted paste events only" }
-          },
-          {
-            path: "value",
-            label: "Length of the pasted text",
-            category: "behavior",
-            exposure: "size",
-            transform: { note: "inserted length only; values are compared in memory and discarded" }
           }
         ]
       },
       [inputField],
       logger,
-      (ts, _inserted, captureSeq) => {
+      (ts, captureSeq) => {
         this.changes.flush();
         this.changes.markInputObserved();
         const oldLength = this.changes.previousLength;

package/dist/analysis/plugins/event-time.mjs

@@ -0,0 +1,18 @@
+// src/plugins/event-time.ts
+function eventTime(stamp) {
+  if (typeof stamp !== "function") return {};
+  return {
+    // Guarded here, not in the tracker: the core only pays for the hook call.
+    eventTime: (explicitTimestamp) => {
+      try {
+        const stamped = stamp(explicitTimestamp);
+        return typeof stamped === "number" && Number.isFinite(stamped) ? stamped : void 0;
+      } catch {
+        return void 0;
+      }
+    }
+  };
+}
+export {
+  eventTime
+};

package/dist/analysis/readers/input-paste.mjs

@@ -10,7 +10,9 @@ var InputPasteObserver = class {
       input.addEventListener("beforeinput", this.onBeforeInput, true);
     }
   }
-  before = null;
+  lengthsBefore = null;
+  /** An input event of this paste arrived (the browser applied it). */
+  applied = false;
   timestamp = 0;
   captureSeq;
   pasteEvent;
@@ -22,21 +24,23 @@ var InputPasteObserver = class {
   };
   /** An unrelated input event invalidates pending paste provenance before recording its change. */
   handlesInput(event) {
-    if (!this.before) return false;
+    if (!this.lengthsBefore) return false;
     const inPasteDispatch = this.pasteEvent?.type === "paste" && (this.pasteEvent.eventPhase ?? 0) > 0;
     if (event.inputType === "insertFromPaste" || inPasteDispatch) {
+      this.applied = true;
       return true;
     }
     this.clear();
     return false;
   }
   get pending() {
-    return this.before !== null;
+    return this.lengthsBefore !== null;
   }
   begin(event) {
-    if (!event.isTrusted || this.before) return;
+    if (!event.isTrusted || this.lengthsBefore) return;
     try {
-      this.before = this.inputs.map((input) => input.value);
+      this.lengthsBefore = this.inputs.map((input) => input.value.length);
+      this.applied = false;
       this.pasteEvent = event;
       this.timestamp = Date.now();
       this.captureSeq = this.reserveCaptureSeq?.();
@@ -47,27 +51,15 @@ var InputPasteObserver = class {
     }
   }
   flush() {
-    const before = this.before;
-    if (!before) return;
+    const lengthsBefore = this.lengthsBefore;
+    if (!lengthsBefore) return;
     const timestamp = this.timestamp;
     const captureSeq = this.captureSeq;
+    const applied = this.applied;
     this.clear();
     try {
-      let inserted = 0;
-      let changed = false;
-      this.inputs.forEach((input, index) => {
-        const old = before[index];
-        const value = input.value;
-        if (old === value) return;
-        changed = true;
-        let start = 0;
-        while (start < old.length && start < value.length && old[start] === value[start]) start++;
-        let end = 0;
-        while (end < old.length - start && end < value.length - start && old[old.length - end - 1] === value[value.length - end - 1])
-          end++;
-        inserted += value.length - start - end;
-      });
-      if (changed) this.changed(timestamp, inserted, captureSeq);
+      const changed = applied || this.inputs.some((input, index) => input.value.length !== lengthsBefore[index]);
+      if (changed) this.changed(timestamp, captureSeq);
     } catch (error) {
       this.logger.error("Failed to finish paste observation", error);
     }
@@ -75,7 +67,8 @@ var InputPasteObserver = class {
   clear() {
     if (this.timer !== null) clearTimeout(this.timer);
     this.timer = null;
-    this.before = null;
+    this.lengthsBefore = null;
+    this.applied = false;
     this.pasteEvent = void 0;
   }
   destroy() {

package/dist/analysis/tracker-core.mjs

@@ -133,6 +133,7 @@ var CorbadoTrackerCore = class _CorbadoTrackerCore {
       if (plugin.session) this.bridge = plugin.session(this) || this.bridge;
       if (plugin.rawErrors) this.rawErrors = plugin.rawErrors;
       if (typeof plugin.sourcePath === "function") this.fixedSourcePath = plugin.sourcePath;
+      if (plugin.eventTime) this.eventClock = plugin.eventTime;
     });
     if (options.fixedDataConfig?.crossOriginSession && !this.bridge) {
       this.logger.warn("fixedDataConfig.crossOriginSession is ignored without the crossOriginSession() plugin");
@@ -273,6 +274,8 @@ var CorbadoTrackerCore = class _CorbadoTrackerCore {
   rawErrors;
   /** Fixed source path of a plugin; undefined = the server-driven `sourcePathQuery` policy. */
   fixedSourcePath;
+  /** Event clock of a plugin (never throws); undefined or an undefined result = `explicitTimestamp ?? Date.now()`. */
+  eventClock;
   /** @internal Shared passive page observation and per-operation context registration. */
   getWindowObserver() {
     return this.windowObserver ??= new SharedWindowObserver(
@@ -891,7 +894,7 @@ var CorbadoTrackerCore = class _CorbadoTrackerCore {
       if (name === AuthEventName.FlowFinished || name === AuthEventName.FlowAutoFinished || name === AuthEventName.FlowReset) {
         this.windowObserver?.flushInputs();
       }
-      const timestamp = explicitTimestamp ?? Date.now();
+      const timestamp = this.eventClock?.(explicitTimestamp) ?? explicitTimestamp ?? Date.now();
       const capturedId = capture?.id ?? uuidv7();
       const capturedSessionId = capture?.sessionId ?? this.sessionId;
       const nextSeq = this.nextSeq();

package/dist/analysis/version.mjs

@@ -1,6 +1,6 @@
 // src/version.ts
 var SDK_NAME = "@corbado/observe";
-var SDK_VERSION = true ? "1.13.0" : "0.0.0-dev";
+var SDK_VERSION = true ? "1.14.1" : "0.0.0-dev";
 export {
   SDK_NAME,
   SDK_VERSION